Privacy policy

Aftertype is operated by Richard Lemon, trading as Studio Aftertype (KvK 42154320), Stadhoudersstraat 25, 6224 TK Maastricht, The Netherlands. Questions or privacy requests can be sent to support@aftertype.studio.

This website uses Cloudflare Web Analytics to understand aggregate traffic and real-world page performance. It reports information such as page paths, referring sites, country, device type, browser, operating system, page-load timing, and Core Web Vitals.

Cloudflare states that Web Analytics does not collect or use visitors' personal data, does not track individual visitors across websites, and does not use cookies, local storage, or fingerprinting for these measurements. Aftertype uses the resulting aggregate statistics only to understand which pages are useful and to improve site reliability and performance.

Cloudflare processes the measurement data as our infrastructure and analytics provider. Unsampled Web Analytics data is retained by Cloudflare for seven days and subsequently aggregated; dashboard analytics are currently available for up to six months. More information is available in Cloudflare's Web Analytics and privacy documentation.

This website also uses Plausible Analytics to see which pages and sources lead visitors to a theme, its demo, its documentation and its checkout. It records page paths, referring sites and campaign tags, browser, operating system, device type, approximate location (country, region and city), and a small number of events: a click to a live demo, a click to a theme's documentation, and the start of a checkout, each labelled only with the theme concerned.

Plausible states that it does not use cookies, browser storage or persistent identifiers. Your IP address and browser information are combined with a salt that is deleted every 24 hours and turned into a daily identifier; the IP address itself is not stored. Aftertype does not send names, email addresses or other personal data to Plausible, and uses the resulting statistics only to understand which pages and channels are useful.

Plausible Analytics, a company incorporated in Estonia, processes this data on our behalf and states that the data is processed and stored in the European Union and does not leave it. The statistics are kept for as long as Aftertype uses the service and are deleted with the site.

The "Get notified" buttons on the product pages (shown for a product that is not yet on sale) open your own email application using a mailto link. The website itself does not capture or store your email address when you click it. If you choose to send an email, Aftertype receives the address and content you provide and uses them to respond to your request or, where explicitly requested, to contact you about the launch.

Support and other emails are retained only for as long as reasonably needed to handle the request, maintain relevant business records, resolve disputes, or meet legal obligations.

Cloudflare Web Analytics and Plausible Analytics do not use cookies. Aftertype does not currently set advertising, personalization, or other non-essential cookies.

Cloudflare may use strictly necessary security cookies when required to provide network security or protect the website from malicious traffic. These cookies are not used by Aftertype for advertising or behavioral analytics.

Purchases run through Stripe Managed Payments, with Link acting as merchant of record. When you start a checkout you are handed over to Stripe's own payment page. Aftertype does not see, receive, or store your card details at any point; Stripe and Link collect your email address, payment details, the billing country and, if you buy as a business, the VAT identification number you enter. They act as the seller for that transaction and process that data under their own terms and privacy notice, which are presented at checkout.

After a successful payment Stripe notifies Aftertype's delivery service, which creates your order, generates your licence key and issues a one-time download link.

Aftertype's own order records contain the email address used at checkout, the name and company name if you provided them, the Stripe identifiers for the session and payment, the amount and currency, the purchase date, the product version, the order status, your licence key, and the dates on which your included support period ends.

Download and account links are never stored as such: only an irreversible SHA-256 hash of each link is kept, together with its expiry and whether it has been used. Requests for a new access link are logged with keyed one-way hashes of the email address and the requester rather than the values themselves, purely to enforce rate limits and to keep a minimal audit trail. A record of each transactional email is kept with its status and, if sending failed, a short error message.

No advertising or profiling data is collected, no cookies are set on the account service, and it is excluded from search engines.

Transactional email, meaning your delivery message and any access link you request, is sent through Resend from a subdomain of aftertype.studio. Resend receives the recipient address and the content of the message in order to deliver it.

Replies and direct support email arrive at support@aftertype.studio, which is hosted on Google Workspace.

Order records and licences are stored in a Cloudflare D1 database provisioned in Western Europe, and the theme files themselves are stored in a private Cloudflare R2 bucket that is only reachable through the delivery service. The release files contain no personal data.

Order and licence records are kept for as long as the licence is valid and, after that, for as long as Dutch law requires business records to be retained, which for tax administration is seven years. Expired and used access tokens and rate-limiting records are short-lived and are not kept beyond their purpose. Support email is retained only for as long as reasonably needed to handle the request, resolve disputes, or meet legal obligations.

Order, licence and delivery data are processed to perform the agreement with you: without them the product cannot be delivered, the licence cannot be issued, and support cannot be provided. Retention of financial records afterwards rests on a legal obligation under Dutch tax law.

Rate limiting, the hashed access audit and basic security measures rest on a legitimate interest in keeping the service available and preventing abuse, weighed against the fact that the data involved is minimal and stored in hashed form.

Aftertype relies on Stripe and its Link service for payment and as merchant of record, Cloudflare for hosting, the database and file storage, Resend for transactional email, and Google Workspace for support email. Each of these providers processes data under its own terms and privacy notice.

Some of these providers, including the Link entity that appears as the seller on your receipt, operate from or transfer data to the United States. Those transfers take place under the transfer mechanisms and safeguards those providers publish in their own data-protection documentation.

If advertising analytics, personalized marketing, or another technology requiring consent is introduced later, it will not be activated for relevant visitors before an appropriate consent mechanism and corresponding policy update are in place.

Where Aftertype processes personal data about you, you may have rights to access, correct, erase, restrict, or object to that processing and, where applicable, to data portability or withdrawal of consent. Send a request to support@aftertype.studio. You also have the right to lodge a complaint with the Dutch Data Protection Authority or your local supervisory authority.

Updated 6 September 2026, the day Northline went on sale, to describe the actual production checkout, delivery and email flow rather than the pre-launch situation, and confirmed the same day by the external reviewer who read the other legal texts.

Updated 10 October 2026 to cover Azimuth, which is sold through the same checkout, delivery and email flow, and confirmed the same day by the external reviewer.

Updated 21 October 2026 to cover Sounding, which is sold through the same checkout, delivery and email flow; confirmed on 20 October 2026 by the external reviewer.

Updated 21 October 2026 to add Plausible Analytics, a cookieless analytics service, and confirmed the same day by the external reviewer.